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INTRODUCTION 


This report presents the results of our evaluation of the year 2000 (Y2K) readiness of 
automated information systems at the Bureau of Indian Affairs. The objective of our review 
was to determine whether the Bureau (1) inventoried its automated information systems and 
identified those systems that were mission critical and were not Y2K compliant, (2) 
developed auditable cost estimates for renovating systems to be Y2K compliant, (3) 
identified by name an individual responsible for ensuring that the Bureau is Y2K compliant, 
(4) ensured that responsible individuals’ personnel performance evaluation plans included 
critical elements related to identifying and remedying Y2K problems, (5) developed a 
credible plan that included milestones and a critical path to ensure that the Bureau is Y2K 
compliant, and (6) developed a contingency plan that would address the failure of any part 
of the systems not being Y2K ready. This review was conducted at the request of the 
Department of the Interior’s Chief Information Officer to assist the Information Officer in 
monitoring the progress of Departmental agencies in ensuring Y2K readiness, implementing 
Y2K compliant systems, and validating the accuracy of the information reported by the 
bureaus and Departmental offices to the Chief Information Officer. 


BACKGROUND 


The "Y2K problem" is the term used to describe the potential failure of information 
technology systems, applications, and hardware related to the change to the year 2000. 
Many computers that use two digits to keep track of the date will, on January 1, 2000, 
recognize "double zero" not as 2000 but as 1900. This could cause computers to stop 
running or to start generating erroneous data. The problem has been recognized as nationally 





significant by the President in Executive Order No. 13073, issued in February 1998. The 
Secretary of the Interior, in a December 1997 memorandum, stated that the Y2K problem 
was critical to the Department’s meeting its mission and that resolution of the problem was 
one of his highest priorities. Further, Office of Management and Budget Memorandum 
98-02, "Progress Reports on Fixing Year 2000 Difficulties," issued on January 20, 1998, 
requires all Federal executive branch agencies, to ensure that Federal Government systems 
do not fail in the year 2000, to have all systems, applications, and hardware renovated by 
September 1998; validated by January 1999; and implemented (that is, "fixes to all systems-- 
both mission critical and nonmission critical") by March 31, 1999, to ensure that Federal 
Government systems do not fail in the year 2000. The Office of Management and Budget 
states in Memorandum 98-02 that it is to provide "information to the Congress and the public 
as part of its [Office of Management and Budget’s] quarterly summary reports on agency 
progress . . . [and] to report on the status of agency validation and contingency planning 
efforts and on progress in fixing . . . equipment that is date sensitive." 


The Department has a multitiered approach to managing the Y2K problem that includes a 
top tier comprising the Secretary of the Interior; the Information Technology Steering 
Committee, which comprises the Chief of Staff and Assistant Secretaries; and the Chief 
Information Officer, who is responsible for the Department’s Y2K issues. This tier, which 
represents senior-level Departmental managers, provides the Y2K project’s overall direction 
and resources and ensures accurate reporting to external organizations such as the Office of 
Management and Budget and the Congress. A Departmentwide Y2K project team, which 
reports to the Chief Information Officer and comprises representatives from each agency and 
the Office of the Secretary, is tasked with developing the Department’s Year 2000 
Management Plan, refining inventory data on the Department’s mission-critical and 
information technology portfolio systems,’ and monitoring and reporting the progress of each 
conversion. In addition, a Y2K Embedded Microchip? Coordinators Team has been 
established to inventory and monitor embedded microchip technology Y2K problems. The 
team is led by the Office of Managing Risk and Public Safety and comprises representatives 
of the eight Departmental bureaus, the Denver Administrative Service Center, and various 
Departmental offices. The Department has developed the "Department of the Interior Year 
2000 Management Plan," which focuses on resolution of the Y2K problem and provides an 
overall strategy for managing Departmental mission-critical systems and infrastructure. 


The Department’s February 1998 "Year 2000 Management Plan," which was submitted to 
the Office of Management and Budget, reported that the Department had 95 mission-critical 
systems. Of the 95 mission-critical systems reported by the Department to the Office of 
Management and Budget, the Bureau of Indian Affairs and the Office of the Special Trustee 


'The portfolio systems is an inventory listing of 13 cross-cutting or sensitive systems that are receiving 
attention at the Secretarial level. 


2Embedded microchips are "integrated circuits (miniature circuit boards)" that "control electrical devices" 
which include "elevators; heating, ventilation, and air conditioning (HVAC) systems; water and gas flow 
controllers; aircraft navigational systems; and . . . medical equipment" and office devices such as telephones, 
facsimile machines, pagers, and cellular telephones. (Department of the Interior’s Office of Managing Risk 
and Public Safety "Year 2000 Embedded Microchip Hazards" [Website]}). 
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for American Indians had 15 systems (see Appendix 1), of which 4 are included in the 
Department’s information technology portfolio.’ To address the Y2K problems, the Bureau 
and the Office of the Special Trustee established a project management team comprising 
senior executives and a task group. The senior executives are the Acting Director, Office of 
Management and Administration, Bureau of Indian Affairs, and the Deputy Director for 
Operations, Office of the Special Trustee. The task group comprises a manager and a 
coordinator from the Office of Information Resources Management and nine members from 
the Bureau’s Operations Service Center (3) and other Program offices (5) and the Office of 
the Special Trustee’s Office of Trust Funds Management. 


SCOPE OF EVALUATION 


To accomplish our objective, we reviewed the documentation available that supported the 
Bureau of Indian Affairs information submitted to the Department’s Chief Information 
Officer through February 1998. We performed our review at the Bureau’s Operations 
Service and Facilities Management and Construction Centers and the Office of the Special 
Trustee for American Indians Office of Trust Funds Management, all of which are located 
in Albuquerque, New Mexico. We interviewed personnel responsible for project 
coordination to identify the Bureau’s Y2K plans and progress.‘ We also interviewed 
personnel involved in various aspects of the Y2K project, including coordination, 
compliance identification, software remediation, and project management. 


The evaluation was conducted in accordance with the "Quality Standards for Inspections," 
issued by the President’s Council on Integrity and Efficiency and, accordingly, included such 
tests and inspection procedures considered necessary to accomplish the objective. Our 
conclusions on the status of the progress made by the Bureau in addressing and remediating 
Y2K problems were based on reviews of documentation maintained by the Operations 
Service Center and discussions with the Y2K coordinator and the Y2K task group members 
who performed remediation or replacement of noncompliant applications or hardware. As 
specifically agreed to in our discussions with the Department’s Chief Information Officer, 
we did not validate or certify that the Bureau’s systems were Y2K compliant. 


3The four Bureau of Indian Affairs and Office of the Special Trustee for American Indians applications or 
systems contained in the Department's information technology portfolio are the Individual Indian Monies (IM); 
Land Records Information System (LRIS); Omni Trust ES; and Facilities, Construction, Operations, and 
Maintenance (FACCOM) system. 


“The Bureau of Indian Affairs is responsible for remediating the Y2K problem for existing systems, such as the 
Individual Indian Monies system of the Office of Trust Funds Management, Office of the Special Trustee for 
American Indians. 





RESULTS OF EVALUATION 


Although the Bureau’s Y2K project management had begun to identify systems and had 
developed a master plan for remedying Y2K problems, it had not completed any of the six 
objectives that the Chief Information Officer had requested us to evaluate. The specific 
actions taken by the Bureau related to each objective are discussed in the paragraphs that 
follow. As a result of not completing the objectives, we believe that there is an increased risk 
that the Bureau may not meet the Office of Management and Budget’s target date of March 
1999 for having compliant Y2K systems implemented. The Bureau has recently awarded 
contracts to assist in its assessment, renovation, and implementation of compliant systems; 
therefore, we have not made any recommendations. However, the Bureau should ensure that 
sufficient resources are made available to meet its milestone dates. 


Automated Information Systems Inventory 


All of the Bureau’s mission- and nonmission-critical automated information systems may not 
have been included in its inventory. According to the Department’s milestone dates, 
agencies were required to have mission-critical systems inventoried and systems that were 
not Y2K compliant identified by June 1997. Although national systems that were deemed 
mission critical’ by the Bureau had been identified and noncompliance had been determined, 
8 of the 12 Bureau area offices and 10 of 15 Bureau program and division offices had not 
responded to inventory requests made by the Bureau’s Director, Office of Management and 
Administration, dated January, July, and September 1997. Therefore, the Bureau had little 
assurance that all mission- and nonmission-critical systems had been identified and reported 
to the Department’s Chief Information Officer. 


Auditable Cost Estimates 


The documentation used to support the Bureau’s cost estimates for correcting the Y2K 
problem in each of the Bureau’s 15 mission-critical systems was not maintained. To 
accurately report the costs associated with correcting the Y2K problem, Office of 
Management and Budget guidelines state that costs to rectify noncompliant Y2K systems 
should be specifically related to Y2K efforts, such as repairing the lines of source code‘ or 
replacing the systems. If a noncompliant system is to be replaced for reasons not specifically 
attributable to Y2K, the cost of replacement should not be reported as a cost to correct the 
Y2K problem. However, any contract costs that are associated with the Bureau’s efforts in 
assessing, renovating, and implementing Y2K-ready systems should be included in the 
Bureau’s cost estimates. 





‘These systems were deemed mission critical based on the systems’ effect on accounting for and distributing 
funds to organizations, tribes, and individual Indians. 


6Lines of source code are statements and instructions used by the computer to execute the tasks of computer 


programs. (Computer Desktop Encyclopedia, Version 9.4, 4th quarter, 1996) 





Although the Bureau’s cost estimates were not auditable, we attempted to determine whether 
the methodology used by the Y2K task group to develop cost estimates was reasonable based 
on a "re-creation" of cost estimates for 2 of the 15 systems. The original methodology used 
by the Bureau was based on an estimate of the percentage of date-sensitive lines of source 
code to the total number of lines of source code multiplied by the Gartner Group’s’ estimated 
cost of $1.70 per line of source code to be corrected. We determined that the methodology 
used to develop the costs was reasonable; however, the estimates had not been updated to 
reflect more recent information that may affect the estimates. For example, applications that 
run on the UNISYS platform were being "cleaned up" by deleting unnecessary lines of source 
code, including the Oil and Gas module that had its total lines of source code reduced from 
43,989 to 41,250. The methodology used by the Bureau may require that the estimated lines 
of source code requiring remediation and the associated cost estimate be reduced. Also, the 
cost to correct the Facilities, Construction, Operations, and Maintenance (FACCOM) system, 
which is run on the IBM mainframe platform, for Y2K compliance will not be accomplished 
through the code remediation effort, as originally anticipated by the Bureau. Instead, the 
FACCOM system is scheduled to be replaced by March 1999. The replacement system is 
necessary to allow the system to operate with current mainframe or client/server operating 
systems, not for reasons directly related to correcting Y2K problems. Therefore, the 
estimated cost of $254,000 reported to correct the Y2K problem for the FACCOM Ten 
was overstated. 


In addition, the cost of $4.8 million to remediate the Y2K problem in the Individual Indian 
Monies (IIM) system as reported to the Department was incorrect. The $4.8 million was the 
estimated cost for the first year of development and implementation of the IM replacement 
system. The IIM is being replaced for a number of reasons, such as to meet the requirements 
mandated by the American Indian Trust Fund Management Reform Act of 1994, not just to 
correct the Y2K problem; therefore, the $4.8 million reported to remediate the Y2K problem 
was overstated. However, because the IIM replacement system is not planned to be 
implemented until after the year 2000, costs to repair the existing system should be estimated 
and reported to the Department. 


Designation of Responsible Individuals 


The Departmental Chief Information Officer requested that we determine whether 
responsible officials had been specifically named. As of March 18, 1998, the Assistant 
Secretary for Indian Affairs had designated, by title, the Y2K executive; by office, the Y2K 
coordinating office; and by name, the individuals who made up the Y2K task group. In 
addition, a representative from the Office of the Special Trustee was included as part of the 





7A computer services company that provides independent advice to business professionals making information 
technology decisions. 


*The task group estimated that about 10 percent of its total lines of source code were date sensitive. For 
example, if a system had 425,000 lines of source code, 42,500 lines of source code would be date sensitive and 
thus would require repair. The 42,500 was then multiplied by the Gartner Group’s cost estimate of $1.70 to 
repair a line of source code, which would result in an estimated cost of $72,250. 


5 





Bureau’s Y2K task group. We believe that designating the Y2K executive by title and the 
Y2K coordinating office by office rather than by name and title of individuals did not meet 
the intent of the Chief Information Officer’s request to have responsible individuals named. 


Annual Personnel Performance Evaluation Plans 


The Secretary of the Interior’s December 1997 memorandum and the Assistant Secretary for 
Indian Affairs February 1998 memorandum required that "a critical performance element for 
identifying and remedying the Y2K" problem be included as part of each responsible 
official’s annual performance plan. Responsible officials are defined in the memorandum 
as agency directors, agency Y2K executives, agency information resources management 
coordinators, safety officials, and all others as determined by the Y2K executive. In addition, 
the Assistant Secretary required that the elements be included in the annual personnel 
performance plans by February 27, 1998. However, as of March 18, 1998, we found that 
except for one member of the Y2K task group, the elements were not included in the annual 
personnel performance plans of the Bureau’s and the Office of the Special Trustee’s Y2K 
executives and the individual members of the Y2K task group, which included the Director, 
Information Resources Management. 


Plan for Milestones 


We found no documentation to support the milestones established by the Bureau. The 15 
systems included in the Bureau’s inventory were being evaluated and remediation was 
planned for Y2K compliance. However, the milestone dates established in the Bureau’s Y2K 
master plan for analyzing existing code had slipped by approximately 2 months. According 
to a member of the Y2K task group, these dates were not met because the software tool 
planned for use in identifying and assisting in remediating lines of source code was originally 
estimated to be available in January 1998; however, as of March 18, 1998, the tool had not 
been purchased. Therefore, the current Y2K master plan may not reflect achievable 
milestone dates. However, Bureau officials indicated at the exit conference and in the 
Bureau’s written response that they believed the acquisition of the "Millennium Solution" 
tool has brought the Bureau back on schedule. 


Contingency Plans 


We found that a formal contingency plan had been developed for only 1 of the 15 mission- 
critical systems. Since the milestone dates established by the Bureau have slipped by 
approximately 2 months, there may be a need for formalizing contingency plans for the 
remaining 14 systems. If additional mission-critical systems are subsequently identified (see 
section "Automated Information Systems Inventory" in this report), contingency plans for 
these systems may also need to be developed. However, the Y2K task group member 
responsible for the Bureau’s application software and national systems stated that once the 
software tool was acquired, the milestone dates established in the master plan for the 15 
systems could be met through personnel efforts such as increasing the number of shifts 
worked and the number of contractor staff. 





Other Issues 


The Department of the Interior and the Office of Management and Budget required that an 
inventory of all data exchanges with outside parties be completed by February 1, 1998, and 
that coordination with these parties to determine a transition plan occur by March 1, 1998. 
The Assistant Secretary for Indian Affairs had established a March 30, 1998, target date for 
the Y2K task group to contact the tribes and tribal organizations to ensure that systems which 
interface with Bureau systems are Y2K compliant. However, we found that the letter 
requesting information from the Bureau’s data exchange partners to accomplish the 
coordination effort had not been issued as of March 18, 1998. 


The Bureau has reported to the Departmental Chief Information Officer that it has four 
systems which are compliant except for independent verification and validation. However, 
the Bureau has not conducted regression testing,’ integrated testing, or Y2K testing on 
these systems. Instead, the Bureau’s Y2K project management has relied on the recent 
design and implementation of these systems. 


On May 12, 1998, we held an exit conference to discuss a preliminary draft of the report 
with Y2K officials from the Bureau and the Office of the Special Trustee and with the 
Department’s Deputy Chief Information Officer. Office of the Special Trustee officials 
generally agreed with our findings but provided no written response to the report. Bureau 
officials also generally agreed with our findings and provided additional information in a 
May 15, 1998, response (see Appendix 2). Based on the discussions and the response, we 
made changes to the report as appropriate; however, we did not revise our report to reflect 
changes or improvements made by the Bureau since March 18, 1998. In its response, the 
Bureau stated that contracts had been awarded and corrective actions were being taken to 
ensure that its automated information systems will be Y2K compliant. 


The legislation, as amended, creating the Office of Inspector General requires semiannual 
reporting to the Congress on all audit reports issued, the monetary impact of audit findings, 
actions taken to implement audit recommendations, and identification of each significant 
recommendation on which corrective action has not been taken. 


We appreciate the assistance of personnel at the Bureau of Indian Affairs and the Office 
of the Special Trustee for American Indians in the conduct of our audit. 


In software development, "regression testing" is defined as "testing a program that has been modified in order 


to ensure that additional bugs have not been introduced." (Computer Desktop Encyclopedia, Version 9.4, 4th 
quarter, 1996.) 


"Integrated" is defined as "a collection of distinct elements or components that have been built into one unit." 


(Computer Desktop Encyclopedia, Version 9.4, 4th Quarter, 1996.) 
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BUREAU OF INDIAN AFFAIRS MISSION-CRITICAL 


System Name or Acronym Description 


Social Services 


Individual Indian Monies 
(IIM) 


Land Records Information 
System (LRIS) 


Omni Trust ES 


Facilities, Construction, 
Operations, and 
Maintenance (FACCOM) 


National Indian Irrigation 
Management System 
(NIMS) 


SYSTEMS INVENTORY’ 


A system that processes general assistance 
payments to individual Indians. 


Tracks funds due individual Indians and tribes 
from leasing, permits, and other uses of Indian 
lands. (Interfaces with IRMS.) 


A land title system showing and tracking 
Indian ownership, including all rights 
conveyed or changed over time. Provides 
official reports for title status and probate 
inventory. 


A system for tracking funds applied to Indian 
trust accounts and allotments to individual 
Indians. Records investing and payout 
information. (Interfaces with IRMS.) 


Maintains facilities inventory data, prioritizes 
deferred maintenance deficiencies, monitors 
progress of constructions projects, and 
calculates operations and maintenance funding 
for all property owned or operated by the 
Bureau of Indian Affairs. 


Tracks and bills assessments for costs of 
operations and maintenance of Indian 
irrigation projects to be reimbursed to the 
Government. 


Estimated 
Cost for 


Compliance 
$72,250 


$4,800,000 


$68,000 


$254,000 


$42,500 


“Information for system name or acronym and for description is from the Bureau of Indian Affairs, and 
information for estimated costs is from the February 1998 “Department of the Interior Year 2000 Management 


Plan.” 
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Estimated 
Cost for 
System Name or Acronym Description Compliance 
Lease/Range - Subsystem A system for managing payouts for leases on $43,000 
of the Integrated Records Indian lands, based on interests in contracts on 
Management System Indian lands. 
(IRMS) 
Owner - Subsystem of the A system that tracks ownership of Indian tribal $35,000 
Integrated Records and trust lands. 
Management System 
(ARMS) 
People - Subsystem of the A census and demographic database on $34,700 
Integrated Records individuals who are enrolled members of 
Management System tribes or who have interests in Indian trust 
(IRMS) assets. 
Royalty Distribution and A tracking system for mineral and surface land $9,200 
Reporting System (RDRS) ownership for oil and mineral leases. 
Lease Distribution A payout system for leases on Indian trust $1,700 
lands 
Loan Management A loan management and accounting system for 0 
Accounting System economic development programs. 
(LOMAS) 
Osage Annuity System A system to pay out monies to members of the 0 
Osage Tribe who are decedents of the original 
Head Right owners. 
Tribal Allocation Priority A system that is used to develop budget $5,000 
System (TAPS) estimates based on tribal priorities. 
Land Title Mapping A geographical information system (GIS) that 0 
System (GIS) has been tailored to support the use and 
application of spatial data technologies 
throughout the Bureau of Indian Affairs. 
Reports boundary and ownership in a land 
status map. 
Total 365,350 
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Memorandum May 15, 1998 


To: Diane Sandy, Office of Inspector General 
Department of the Interior 


Linda Richardson, Office of Audit & Evaluations 


Bureau of Indian Affairs 

From: Nancy Jemison, Year 2000 Executive ra eae 
Bureau of Indian Affairs 

Subject: Year 2000 Review 


This is a follow up the telephone exit conference held on Tuesday May 12, 1998. 


Attached, you will find the Bureau of Indian Affairs (BIA) response to the Year 2000 audit 
review. Also attached, you will find a working draft, of the BIA Year 2000 Master Plan. 


During the telephone exit conference reference was make about publishing this information 


to the IG Web site. The BIA's Y2K Master Plan is a working draft, for this reason we do not 
want this document published on any Web site , at this point in time. 


RESPONSE TO DOI INSPECTOR GENERAL’S SURVEY REPORT 
YEAR 2000 REVIEW 
BY 
THE BUREAU OF INDIAN AFFAIRS 


15 MAY 1998 


Automated Information Systems Inventory 


All of the Bureau’s mission and nonmission-critical automated information systems may 
not have been included in its inventory. According to the Department’s milestone dates, 


10 
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agencies were required to have mission-critical systems inventoried and systems that were 
not Y2K compliant identified by June 1997. Although national systems that were deemed 
mission critical’ by the Bureau had been identified and noncompliance had been 
determined, 8 of the 12 Bureau area offices and 10 of 15 Bureau program and division 
offices had not responded to inventory requests made by the Bureau's Director, Office of 
Management and Administration, in January, July, and September 1997. Therefore, the 
Bureau had little assurance that all mission and nonmussion-critical systems had been 
identified and reported to the Department’s Chief Information Officer. 


BIA Response: 


The BIA has placed our highest priority on the inventory of National Systems, which are 
mission critical. BIA’s OIRM OSC is responsible for maintaining all the National 
Applications, most of which are housed on the Unisys platform in ALBQ or on the IBM 
in Reston at USGS. BIA expected a small response to the mventory request of these 
national systems from area, agency or school offices. 


We recognize that there may be local safety and/or program essential systems in local 
facilities. In order to gain cooperation from areas, agencies and schools, the BIA Y2K 
team has visited the following areas as of May 15: Aberdeen, Billings, Navajo, Portland, 
Phoenix, and Sacramento. The Y2K Team will visit the remamuing Areas within the next 
30 days. The result of our visits is a much higher participation from local offices. As of 
May 15, 70% of POC information for embedded systems and telecommunications 
equipment have been received from areas and agencies. These data are being entered into 
an Inventory Database. With the help of Mitretek, we are m the process of sending a 
second data call (See Attachment 1), via the use of electronic forms, to collect inventory 
data of Jess critical components such as personal computers, office automation software, 
local databases, etc. Mitretek is also helping the BIA develop a Year 2000 web site (See 
Attachment 2 for sample screens of the IHS Web site) to facilitate information 
dissenunation and local systems/software/hardware inventory and assessment. Area, agency 
and school Y2K POCS who have Internet access will be able to enter and update inventory 
data for local facilites, check compliance status of hardvware/software against known 
baseline compliance data and/or using procedures, and generate compliance status reports 
online. Tribes are also encouraged to take advantage of this facility to support their Y2K 
compliance needs. 


Auditable Cost Estimates 


‘These systems were deemed mission critical based on the system's effect on accounting for and distributing 
funds to organizations, tribes, and individual Indians. 
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The documentation used to support the Bureau's cost estimates for correcting the Y2K 
problem in each of the Burean’s 15 mission-critical systems was not maintained. To 
accurately report the costs associated with correcting the Y2K problem, Office of 
Management and Budget guidelines state that costs to rectify noncompliant Y2K systems 
should be specifically related to Y2K efforts, such as repairing the lines of source code’ or 
replacing the systems. If a noncompliant system is to be replaced for reasons not 
specifically attributable to Y2K, the cost of replacement should not be reported as a cost to 
correct the Y2K problem. However, any contract costs that are associated with the 
Bureau’s efforts in assessing, renovating, and implementing Y2Kk-ready systems should be 
included in the Bureau’s cost estimates. Although the Bureau's cost estimates were not 
auditable, we attempted to determine whether the methodology used by the Y2K task 
group to develop cost estimates was reasonable based on a "re-creation" of cost estimates 
for 2 of the 15 systems. The original methodology used by the Bureau was based on an 
estimate of the percentage of date-sensitive lines of source code to the total number of 
lines of source code multiplied by the Gartner Group’s’ estimated cost of $1.70 per line of 
source code to be corrected.’ We determined that the methodology used to develop the 
costs was reasonable; however, the estimates had not been updated to reflect more recent 
information that may affect the estimates. For example, applications that run on the 
UNISYS platform were being "cleaned up" by deleting unnecessary lines of source code, 
including the Oil and Gas module that had its total lines of source code reduced from 
48,989 to 41,250. The methodology used by the Bureau would require that the estimated 
lines of source code requiring remediation and the associated cost estimate be reduced. 
Also, the cost to correct the Facilities, Construction, Operations, and Maintenance 
(FACCOM) system, which is run on the IBM mainframe platform, for Y2K compliance 
will not be accomplished through the code remediation effort, as originally anticipated by 
the Bureau. Instead, the FACCOM system is being replaced by March 1999 because the 
source code cannot be remediated so that the system can operate with current mainframe 
or client/server operating systems, not for reasons directly related to correcting Y2K 
problems. Therefore, the estimated cost of $254,000 reported to correct the Y2K 


*Lines of source code are statements and instructions used by the computer to execute the tasks of 
computer programs. (Computer Desktop Encyclopedia, Version 9.4, 4th quarter, 1996) 


°A computer services company that provides independent advice to business professionals making 
information technology decisions. 


‘The task group estimated that about 10 percent of its total lines of source code were date sensitive. For 
example, if a system had 425,000 lines of source code, 42,500 lines of source code would be date sensitive and thus 
would require repair. The 42,500 was then multiplied by the Garmer Group's cost estimate of $1.70 to repair a line 
of source code, which would result in an estimated cost of $72,250. 
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problem for the FACCOM system was overstated. 


In addition, the cost of $4.8 million to remediate the Y2K problem in the Individual 
Indian Monies (IIM) system as reported to the Department was incorrect. The $4.8 
million was the estimated cost for the first year of development and implementation of 
the IIM replacement system. The IIM is being replaced for a number of reasons, such 
as to meet the requirements mandated by the Amenican Indian Trust Fund Management 
Reform Act of 1994, not just to correct the Y2K problem; therefore, the $4.8 million 
reported to remediate the Y2K problem was overstated. However, because the ITM 
replacement system is not planned to be implemented until after the year 2000, costs to 
repair the existing system should be estumated and reported to the Department. 


BIA Response: 


The BIA is in the process of setting up a project file, included in the file mill be all support 
documentation for cost estimates. With Mitretek’s help, the BIA is developing a Year 
2000 Master Plan (See Attachment 3 for a working draft of the BIA Y2K Master Plan). 
The Plan more accurately accounts for Year 2000 compliance expenses. 


The BIA Y2K coordinator had submitted an estimate of $62K for the Year 2000 
remediation of the ITM sub-system to the DOI Y2K coordinator more than one year ago. 
DOI Office of the Special Trustee had submitted Y2K information to the same DOI Y2K 
coordinator. A decision inside DOI led to the decision to include $4.8 million as the Year 
2000 cost for IIM replacement, instead of $62K supplied by BIA. 


Designation of Responsible Individuals 


The Assistant Secretary for Indian Affairs designated, by title, the Y2K executive; by office, 
the Y2K coordinating office; and by name, the individuals who made up the Y2K task 
group. In addition, a representative from the Office of the Special Trustee was included as 
part of the Bureau’s Y2K task group. The Departmental Chief Information Officer 
requested that we determine whether responsible officials had been specifically named. 
We believe that designating responsible individuals by title rather than by name and ttle 
did not meet the intent of the Chief Information Officer's request to have responsible 
individuals named. 


BIA Response: 
The BIA has a Year 2000 project team which was formed in February 1998. The 


Director of Management and Administration is the BIA Year 2000 Executive who is 
responsible for ensuring overall Year 2000 compliance within the BIA, while the Office of 
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Information Resources Management is serving as the Year 2000 coordinating office within 
the BIA. The Director of Facilities Management ts serving as the BIAs Embedded 
Technology Executive. In addition, the following staff ts serving on the BIAS Year 2000 


Task Group: 

Nancy Jemison Year 2000 Executive 

George Gover Year 2000 Manager 

Bill Colter, Jr. Year 2000 Embedded System Executive 

Ed Socks Year 2000 Coordinator 

Mona Infield Year 2000 Application Software & National Systems 
Ron Shepherd Year 2000 WAN/LAN 

Don Mayer Year 2000 Mainframe Hardware & Software 

Dr. Ken Ross Year 2000 Office of Indian Education Programs 
Al Lindfors Year 2000 Embedded Chip 

Byron Carr Year 2000 Telephone/Voice/Data 

Bob McKenna Year 2000 Office of Trust Funds Management 
Craig Jones Year 2000 Law Enforcement 

Bill Bonner Year 2000 GIS Systems 


The BIA’ Year 2000 Task Group is expected to grow as Year 2000 efforts progress 
throughout the BIA’ Area Offices, Agencies, program offices and schools. These local 
offices have begun to form local Year 2000 task groups dedicated to the Year 2000 
compliance effort. To assist in project management and other Year 2000 activities, the 





BIA has selected Mitretek, an independent contractor, to assist the Year 2000 Task Group 
and report its progress to the BIA's Year 2000 Executive. 


Annual Personnel Performance Evaluation Plans 


The Secretary of the Interior's December 1997 memorandum and the Assistant Secretary 
for Indian Affairs February 1998 memorandum required that "a critical performance 
element for identifying and remedying the Y2K" problem be included as part of each 
responsible official's annual performance plan. Responsible officials are defined as 
agency directors, agency Y2K executives, agency information resources management 
coordinators, safety officials, and all others as determined by the Y2K executive. In 
addition, the Assistant Secretary required that the elements be included in the annual 
personnel performance plans by February 27, 1998. However, as of March 18, 1998, we 
found that except for one member of the Y2K task group, the elements were not included 
in the annual personnel performance plans of the Bureau’s and the Office of the Special 
Trustee’s Y2K executives and the individual members of the Y2K task group, which 
included the Director, Information Resources Management. 
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BIA Response: 


The BIA ¥2K Executive had sent out a memo to all areas, agencies and schools for this 
purpose 10 days before IG’s visit. Due to the wide geographical distribution of the BIA’s 
offices, it takes about 2 weeks for the information to be communicated to the lower levels 
of the field offices. This could explain why most of the Y2K project staffers didn’t have it 
included in their annual performance plan at the time of IG’s audit. We believe this has 
become standard practice today. Additionally, the BIA will have a critical performance 
element for identifying and remedying the Y2K added for all field staff who are designated 
as Y2K Point of Contacts(POC). 


Plan for Milestones 


We found no documentation to support that the milestones established by the Bureau 
were achievable. Furthermore, even though the 15 systems included in the Bureau's 
inventory were being evaluated and remediation was planned for Y2K compliance, the 
milestone dates established in the Bureau’s Y2K master plan had slipped by approximately 
2 months. According to a member of the Y2K task group, these dates were not met 
because the software tool planned for use in identifying and assisting in remediating lines 
of source code was originally estimated to be available in January 1998; however, as of 
March 18, 1998, the tool had not been purchased. Therefore, the current Y2K master 
plan may not reflect achievable milestone dates. 


BIA Response: 


DI has demonstrated to BIA its Millennium Solution tool. BIA has tested the tool and 
has been using the tool for assessment and code remediation for the last month. The 
Master Plan had not been slipped by 2 months. 


Milestones and resource requirements are well documented in the attached Year 2000 
Master Plan. 


Contingency Plans 


We found that a formal contingency plan had been developed for only 1 of the 15 
mission-critical systems. Since the milestone dates established by the Bureau have slipped 
by approximately 2 months, there may be a need for formalizing contingency plans for the 
remaining 14 systems. If additional mission-critical systems are subsequently identified 
(see Section "Automated Information Systems Inventory’ in this report), contingency plans 
for these systems may also need to be developed. However, the Y2K task group member 
responsible for the Bureau's application software and national systems stated that once the 
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software tool was acquired, the milestone dates established in the master plan for the 15 
systems could be met through personnel efforts such as increasing the number of shifts 
worked and increasing the number of contractor staff. 


BIA Response: 


The BIA will be developing detailed contingency plans as part of the BIA Y2K Master 
Plan. 


Other Issues 


The deadline established by the Department of the Interior and the Office of 
Management and Budget required that an inventory of all data exchanges with outside 
parties be completed by February 1, 1998, and that coordination with these parties to 
determine a transition plan occur by March 1, 1998. The Assistant Secretary for Indian 
Affairs had established a March 30, 1998, target date for the Y2K task group to contact the 
tribes and tribal organizations to ensure that systems which interface with Bureau systems 
are Y2K compliant. However, we found that the letter requesting information from the 
Bureau’s data exchange partners to accomplish the coordination effort had not been 
issued as of March 18, 1998. 


BIA Response: 


The BIA has sent a letter on 31 March 1998 to all known Data Exchange partners, some 
of which happened to be Tribes. No letters were sent to those Tribes that do not have data 
exchange with the BIA’s systems. As a way of providing Y2K support to the Tribes, we 
invite Tribes to BIA local Year 2000 information meetings and we plan to share our Year 
2000 knowledge base with the Tribes through the use of our Year 2000 web in the near 
future. 


The Bureau has reported to the Departmental Chief Information Officer that it has four 
systems that are compliant except for independent verification and validation. However, 
the Bureau has not conducted regression testing,’ integrated testing,’ or Y2K testing on 


‘In software development, “regression testing" is defined as "testing a program that has been modified in 
order to ensure that additional bugs have not been introduced." (Computer Desktop Encyclopedia, Version 9.4, 
4th quarter, 1996.) 


“Integrated" is defined as “a collection of distinct elements or components that have been built into one 
unit.” (Computer Desktop Encyclopedia, Version 9.4, 4th Quarter, 1996.) 
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_ these systems. Instead, the Bureau’s 2K project management has relied on the recent 
design and implementation of these systems. 


BIA Response: 
The BIA has contracted for Y2K testing support, Anteou has been selected to develop a 


test plan that will address tests mentioned above. A schedule for conducting these tests is 
included in the attached Year 2000 Master Plan. 


If you have any questions on these materials, please refer questions to Ed Socks. Mr. Socks 
served as the audit coordinator for this review, office number 505-248-7156, email address: 
ed_socks@mail.bia.gov 


{NOTE: YEAR 2000 MASTER PLAN NOT INCLUDED BY OFFICE OF INSPECTOR GENERAL. ] 
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ILLEGAL OR WASTEFUL ACTIVITIES 
SHOULD BE REPORTED TO 
THE OFFICE OF INSPECTOR GENERAL BY: 


Sending written documents to: Calling: 


Within the Continental United States 


U.S. Department of the Interior Our 24-hour 

Office of Inspector General Telephone HOTLINE 
1849 C Street, N.W. 1-800-424-5081 or 
Mail Stop 5341 (202) 208-5300 


Washington, D.C. 20240 


TDD for hearing impaired 
(202) 208-2420 or 
1-800-354-0996 


Outside the Continental United States 


Caribbean Region 


U.S. Department of the Interior (703) 235-9221 
Office of Inspector General 

Eastern Division - Investigations 

1550 Wilson Boulevard 

Suite 410 

Arlington, Virginia 22209 


North Pacific Region 


U.S. Department of the Interior (700) 550-7428 or 

Office of Inspector General COMM 9-011-671-472-7279 
North Pacific Region 

238 Archbishop F.C. Flores Street 

Suite 807, PDN Building 

Agana, Guam 96910 









Toll Free Numbers: 
1-800-424-5081 
TDD 1-800-354-0996 


FTS/Commercial Numbers: 
(202) 208-5300 
TDD (202) 208-2420 


HOTLINE 


1849 C Street, N.W. 
Mail Stop 5341 
Washington, D.C. 20240 


mMM omn 
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